e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 06:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
Size

86KB
MD5

6aa15a2c8f2d325f89ba04cf95c8da30
SHA1

519e14b3cd5d476642a2cf778ed638d6749e71ee
SHA256

e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a
SHA512

cf41c318375826df36b7efd9e804690cbd430fc7b41feccefcb0738dfdcee80ff84543122140c377eaa44c8c340232e03f2428456a788d0bed623593a7aa6597
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdYSWO:6e7WpMaxeb0CYJ97lEYNR73e+eBSWO

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3453) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Stanley.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jre7\lib\calendars.properties.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Windows Media Player\en-US\wmpnscfg.exe.mui.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Linq.Resources.dll.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\cli.luac.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\cpu.css.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-compat.xml.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleHandler.dll.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\ShowImport.tif.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\libglspectrum_plugin.dll.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedback.gif.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.change_2.10.0.v20140901-1043.jar.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_s.png.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jre7\lib\resources.jar.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider.png.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_down.png.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libtta_plugin.dll.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Brisbane.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Windows Mail\es-ES\WinMail.exe.mui.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\cpu.html.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Microsoft Games\Chess\it-IT\Chess.exe.mui.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Windows NT\TableTextService\de-DE\TableTextService.dll.mui.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml.tmp	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe

C:\Users\Admin\AppData\Local\Temp\e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe
"C:\Users\Admin\AppData\Local\Temp\e9a4427d9ea3c5bfe298f3efb285900ea058dea147a2535dedd70a294cdbd23a.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
86KB

MD5
cbf6c5805102ddfefeca42062980ad17

SHA1
2bd45dde7cda8f57d0bb57b4ace14f8b090d3393

SHA256
00cc214eeb69ff5e8225fa2473c7d5c722f05933cb8bd149c334f590b89b5e70

SHA512
9b661c8c4e4c221c6613cba31644c50148652ef6dccb56a29c1a63ee92ac829e651714d4021c6574463f3cacd47ba6e6545fc415c94aa092787cbdd2594424ee

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
95KB

MD5
10638a58355952c0fbeeb536b2ee85c2

SHA1
2f935875577e27f2f27420742e48331983e3b532

SHA256
d6023b45a81dcd24c125fd6225f3a4e86737e6e3a7b687ae4fcc9e9bea2fbbec

SHA512
4272f21bfc8727a6a439f12c0c8232160e46a557eb8dc7916251a3f42bc06490d1252df07388a6f43b8539497f3459f9d510a16a5a6a652097811437020355cf

Download Submit